POST and GET have quite obvious cases where they should be used:
GET should only be used for "readonly" pages. Things like searches, displaying info etc.
POST should be used for anything which causes a "change" in data. By a change, I don't mean just updating stats, I mean an actual modification of some data. This includes logon forms, which should use POST.
So basically it's
- GET for searching and displaying stuff
- POST for modifications and anything else.
The reason for this, is that a user agent could repeat a GET without user interaction, and expect the same results (or more up to date results, if user hits refresh etc). But a POST should never be repeated without the user's explicit say-so, as it could cause duplicate data.
I normally have forms post to themselves. This is so that if an error occurs, I can redisplay the form with the entered data already filled in, so the user can try to correct the problem.
If a form POST succeeds, and I want to move to a different screen, typically I'd do a redirect.
I realise there is an efficiency cost with redirects, but it makes good sense. Also this stops the user from hitting "refresh" on POST submitted pages, which can cause problems.
Mark